An unexpected delivery text or email can look convincing, especially when it mentions a real retailer, familiar courier, tracking number, or missed delivery. This checklist explains how to decide whether a package delivery message is legitimate without opening its link, scanning its QR code, or sharing payment and identity information.
Overview
Package delivery scams are phishing attempts designed to make a shipping problem feel urgent. The message may claim that a parcel is waiting for a customs payment, that an address must be confirmed, or that a delivery needs to be rescheduled. Some messages arrive by text, while others use email, voice calls, social media messages, or printed notices.
The safest starting assumption is simple: treat an unexpected delivery notification as unverified until you confirm it through a channel you choose yourself. Do not use the phone number, web address, button, attachment, or QR code supplied in the message. Instead, open the retailer or courier’s official website or app independently, type the address yourself, or use contact details from a genuine order record.
A legitimate tracking message can still contain a link, but the presence of familiar branding does not prove that the message is genuine. Scammers can copy logos, sender names, colors, tracking-page layouts, and delivery language. The message should be checked against an order you actually placed and a tracking record you accessed independently.
Checklist by scenario
You recognize the retailer or order
- Open the retailer’s app or type its known website address manually.
- Review your order history and confirm the item, shipping address, and expected courier.
- Use the tracking number shown in the retailer’s account or order-confirmation email, not the number supplied by the suspicious message.
- Compare the independently retrieved status with the notification. A mismatch is a reason to stop.
If the retailer account shows no matching order, do not assume the message refers to a delayed or newly created purchase. It may be a package delivery scam using a generic claim.
The message asks for a customs fee, redelivery fee, or small payment
Pause before paying. Unexpected fees are a common pressure point because a recipient may worry that a parcel will be returned. Verify the shipment through the courier’s independently accessed website or the retailer that sent the order. Check the exact reason for the charge, the shipment reference, and the available payment process. Do not enter card details, online-banking credentials, one-time codes, or identity documents into a page reached from the message.
Be particularly cautious when payment is requested by gift card, cryptocurrency, bank transfer, peer-to-peer payment, or an unusual payment portal. Those payment methods can be difficult to reverse and are not a safe way to resolve an unverified delivery notice.
The message says your address is incomplete
Do not reply with your full address, date of birth, account password, or other personal information. Sign in to the retailer or courier account independently and check the saved delivery details there. If an address really needs correction, use the platform’s normal account or customer-support process. A request to “confirm” information on a lookalike page may be intended to collect identity data rather than deliver a parcel.
You receive a QR code, attachment, or reschedule link
Do not scan the QR code or open the attachment on the assumption that it is only a delivery label. QR codes can send a phone to a phishing site, and attachments can contain harmful files or fake forms. Visit the courier’s official website or app directly and look for a tracking or delivery-management option. If you cannot find the shipment there, preserve the message for reporting and delete it.
The courier name is familiar but the sender looks unusual
| What to compare | Safer verification method |
|---|---|
| Courier name and logo | Find the courier’s website or app independently; do not rely on branding in the message. |
| Tracking number | Enter it only on the official courier site reached without the supplied link, and confirm it relates to your order. |
| Sender address or phone number | Inspect it, but do not treat a familiar name or local number as proof of authenticity. |
| Payment or customs request | Confirm the shipment and charge through the retailer or courier’s normal support path. |
| Delivery date or missed notice | Compare it with your independently accessed order and tracking records. |
Sender information can be forged or manipulated, so it is only one clue. A verified order and an independently accessed tracking record are stronger evidence.
What to double-check
- Did you expect a package? An unsolicited notification is not evidence that a shipment exists.
- Does the tracking number belong to you? Confirm the number in a retailer account or order record you trust.
- Does the web address match the real service? Look for misspellings, extra words, unusual subdomains, shortened links, or unrelated domains. When in doubt, do not visit it.
- Is the request unusually urgent? Threats that a parcel will be destroyed, returned, or held immediately are pressure tactics.
- Is the requested information proportionate? A delivery issue should not require a password, one-time banking code, full identity profile, or unrelated account details.
- Does the contact method make sense? Move verification to the retailer or courier’s official app, website, or published support channel.
For a broader process covering suspicious messages, calls, and links, use the checklist for checking a suspicious text, email, or phone call before replying. You can also compare a questionable page against the website and online-store verification checklist.
Common mistakes
Searching the phone number and trusting the first result. Search results can include copied pages, advertisements, or reports that do not establish whether the current message is genuine. Use the courier’s known website or app instead.
Clicking only to “look.” A page can collect information, trigger a download, or record a login attempt even if you do not complete the form. Verify without opening the supplied link.
Replying with “STOP” or asking who sent it. A reply may confirm that your number is active or invite a conversation with the sender. Report the message through your mobile provider or relevant platform where available, then delete it.
Calling the number in the notification. A scammer may answer as a fake courier representative and request more information. Find the official contact route independently.
Ignoring an account after entering details. If you clicked a link or submitted credentials, change the affected password from the genuine website, enable multifactor authentication, and review account activity. If payment information was exposed, contact the card issuer or financial institution using its official contact details. For broader recovery steps, see what to do after being scammed.
When to revisit
Keep this checklist available during major shopping periods, when you are expecting several orders, or whenever a courier changes its tracking or delivery workflow. Revisit it after installing a new retailer or courier app, changing your delivery preferences, or receiving a message about a shipment you do not recognize.
Editors and security teams should also review this guidance before seasonal planning cycles and when official courier contact paths, tracking interfaces, or notification practices change. The safest rule remains stable: do not use the supplied link or QR code, verify the shipment independently, and pay or share information only through a trusted process you initiated.
If you already interacted with a suspicious delivery message, save screenshots and the sender details, report the message through the appropriate service, and secure any exposed accounts. A calm pause is often the most effective defense against a delivery text scam.
